Think your website is hacked? Start here.
Run a free scan for the weaknesses attackers use to get in, then work through the signs and steps below. Stay calm: most hacked small sites can be cleaned and hardened in a day.
Common signs
- Visitors, often only on mobile or from Google, are redirected to spam or scam sites.
- A fake “verify you are human” CAPTCHA asks visitors to paste a command (a “ClickFix” attack).
- Google shows “This site may be hacked” or Chrome shows a red warning.
- Pages you never wrote appear when you search
site:yourdomain.com, often in other languages. - New admin users, unknown plugins, or PHP files inside
wp-content/uploads. - Your host suspends the account or your emails start bouncing as spam.
Check what Google sees
- Google Safe Browsing site status: is your site flagged?
- Google Search Console → Security & Manual Actions → Security issues.
- A
site:yourdomain.comsearch for spam pages.
What our scan finds
The free scan shows the open doors: outdated software, known vulnerable plugins, missing protections. After you verify ownership, the deep scan looks for injected code (fake CAPTCHA / ClickFix pages, scripts loaded from blockchains, unknown checkout scripts) and exposed files.
If it is hacked: first steps
- Take a full backup (files and database) before you change anything, so you keep evidence.
- Change every password: hosting, FTP/SFTP, database, WordPress admins, email.
- Follow the WordPress clean-up guide, or ask your host for a malware clean-up.
- Fix the way in: update everything and remove unused plugins and themes.
- Request a review in Search Console once it’s clean.
Frequently asked questions
Can a free online scan tell me if my site is hacked?
It can show warning signs and the weaknesses that lead to hacks. No remote scanner can see every file on your server, so we combine the scan with the manual checks on this page.
Why do only some visitors see the redirect?
Malware often hides from logged-in admins and shows itself only to mobile visitors or people arriving from search, to stay unnoticed.
Is a fake CAPTCHA on my site dangerous?
Yes. These “paste this command” prompts trick visitors into running malware on their own computers. Take the site offline or into maintenance mode and clean it right away.
Guides with copy-paste fixes
Is WordPress hacked?
The signs of a hacked WordPress site, how to confirm it with WP-CLI checksums, and a clean-up checklist: users, files, salts, updates and a Google review.
GuideWordPress hardening
A practical WordPress hardening checklist with copy-paste snippets: block XML-RPC, hide usernames, disable the file editor, protect wp-config.php and stop PHP in uploads.
GuideExposed .git, .env & backups
Leaked .env files, .git folders and database backups hand attackers your passwords. Check if yours are public, block them on nginx or Apache, and rotate the secrets.
More free checks
Find out your grade before someone else does.
Free to start. Paid plans from $12 a month, or a one-time report for $29. See pricing
This page is in English. Translations are on the way.